CertaDNS
Skip to lesson

Auditing a Domain Cold · lesson 3 of 3

The write-up that gets acted on

After this lesson you can

Write a finding that produces a change rather than a ticket nobody closes.

Assumes you have read Ranking by consequence.

A correct finding that nobody acts on has the same effect as no finding. The difference is almost entirely in whether the reader can tell what to do, who does it, and what happens if they do not.

The shape

What is true          one sentence, verifiable
What it permits       the consequence, concretely
What to change        the literal record, before and after
Who changes it        a team, not "the business"
What it risks         the failure mode of the fix itself
How to verify         the command that shows it worked

Two versions of the same finding

Weak:

DMARC policy is not set to an enforcing value. It is
recommended that the organisation implement a DMARC
policy in line with industry best practice.

Strong:

_dmarc.example.com publishes p=none, so receivers take
no action on mail that fails authentication. Anyone can
send invoices as example.com today and they will be
delivered.

Change:   v=DMARC1; p=none; rua=mailto:dmarc@example.com
To:       v=DMARC1; p=quarantine; sp=quarantine; np=reject;
                    rua=mailto:dmarc@example.com

Owner:    the team that administers example.com DNS.
Risk:     legitimate senders not yet aligned will be
          filtered. Four weeks of aggregate reports must
          show every source identified before this change.
Verify:   dig +short TXT _dmarc.example.com

The second version is longer and takes an hour rather than a minute to produce. It is also the one where nobody has to work out what “in line with best practice” means, and where the risk of the fix is stated by you rather than discovered by them.

What makes the difference

  • Name the consequence in the reader’s terms. “Anyone can send invoices as this domain” is actionable. “Non-compliant with DMARC” is not.
  • Give the literal record. Not a description of the record. The person applying it should be able to copy it.
  • State the risk of your own fix. It is the first thing a competent owner will ask, and volunteering it is the difference between a recommendation and an instruction.
  • Separate what is free from what is not. Publishing rua costs nothing and breaks nothing. Moving to reject needs four weeks of evidence. Presenting both as “fix DMARC” guarantees neither happens.
  • Include the verification command. It closes the finding without a meeting.

Lead with the free ones

Every audit contains changes with no downside at all: publishing rua, adding np=reject, revoking a dead selector, a null MX on a parked domain. Putting them first gets something shipped in week one, which is worth more to the programme than the larger finding sitting in a queue behind a risk assessment.

Last reviewed